The present invention relates to a system and method conducted within a single computer for intercepting, examining and controlling data streams flowing via transport connections between the transport layer of an operating system and the user application; and more specifically for protecting the computer from invasion by viruses, trojan horses, worms and other hostile algorithms.
The rise of the Internet and networking technologies has resulted in the widespread sharing of data between computers. This data is not always what it seems to be. Data that is accessed on a remote machine and downloaded to a computer system can contain hostile algorithms that can potentially destroy data, crash the system, corrupt data or worse. Some of these hostile algorithms are viruses, worms, and trojan horses. Viruses are computer programs that parasitically copy themselves into other programs. Worms are independent programs that reproduce by copying themselves from one computer to another over a network. Worms, unlike viruses are not parasitic. Trojan horses are code fragments that hide inside of program that appears to do something else. Quite often Trojan horses hide inside of utility programs or other popular programs that are downloaded. The existing program often performs a useful function while masking the presence of the internal trojan horse. Finally, it is possible for a person to manually enter commands or to direct byte streams to a computer over a network with hostile intent.
Virus, worms, and trojan horses can infect an internal network or single computer system when the internal network or computer system executes a program from the external network that contains the hostile algorithm. All binary executables, unreviewed shell scripts, and source code accessed from an external network may contain worms, viruses, or trojan horses. In addition, outside binary executables, shell scripts, and scanned source code may enter an internal network or single computer system through an E-mail attachment. Also, executables can be directly accessed from an external network through the IFTP program, a world-wide web browser, or an outside contractor whose network already has been compromised.
Firewalls and proxy servers are well known means for protecting an internal network or single computer system from hostile algorithms from an external network. When a firewall is installed, all communication from the external network is routed through a proxy server outside of the internal network, and the proxy server determines whether a particular message or file is authorized to pass through to the internal network.
Reference is now made to FIG. 1, which is a block diagram of a computer information system utilizing a firewall between external and internal network systems. The computer information system 10 contains an external network 11, which may include the internet, which is accessible by hackers 20 or computer viruses 21. Generally, hackers 20 are persons who gain unauthorized access to a computer system. The external network 11 is connected to the firewall by a first incoming bus 12 and a first outgoing bus 13. The bus comprises specialized groups of lines that carry different types of information. A bus has a specific bandwidth, which is the data transfer capacity of a digital communications system. The first incoming bus 12 sends data to the firewall 14. The firewall 14 determines which data is authorized to be transmitted to the internal network 17. The data transferred from the firewall 14 to the internal network is transferred via a second incoming bus 15. In addition, data is sent from the internal network 17 to the firewall 14 via a second outgoing bus 16. Once the data has been transferred to the internal network 17, it can be accessed by users 18 and 19 of the internal network.
In a functional firewall computer system 10, hostile algorithms invading the external network 11 by hackers 20 or computer viruses 21 are transported via the first incoming bus 12 to the firewall 14. Once processed by the firewall 14, the hostile algorithms are denied authorization to flow via second incoming bus 15 to the internal network 17. As a result, the users 18 and 19 of the internal network 17 are not subjected to the problems that can be caused by hostile algorithms.
Generally, the bandwidth of the buses 12 and 13 between the external network 11 and the firewall 14 is equal to the bandwidth of the buses 15 and 16 between the internal network 17 and the firewall 14.
Typical of such firewall systems includes, for example, U.S. Pat. Nos. 5,550,984 to Gelb; 5,623,600 to Ji et al; and 5,815,571 to Finley, all of which are incorporated herein by reference.
Unfortunately, all of the computer systems that utilized firewalls impose a number of disadvantages on the entire system. Initially, the firewalls must be placed at the xe2x80x9cchoke pointxe2x80x9d at which an outside network enters the internal network. This creates a problem in that the firewall becomes a central point of failure, whereby if the firewall fails, the entire connection to the external network fails. In addition, since the bandwidth of the connection between the internal network and the firewall normally is equal to the bandwidth of the connection between the firewall and the external network, the firewall will add latency to the connection by performing its function. This latency normally increases the demand on bandwidth utilization. Very often, the firewall latency will cause utilization of the available bandwidth to degrade such that all available bandwidth cannot be utilized. This can occur either linearly or logarithmically depending upon the specific implementation of the firewall, speed of the bus connections, and resource availability within the firewall.
Another disadvantage is that the connection to the external network is normally limited by the available bandwidth purchased on a detected communications circuit.
Finally, since a firewall does not exist between the users on the internal network, another one of the users of the network can attack the internal system. It is an observation within the security industry that 80% of all attacks against a system originate on the internal network while only 20% of attacks originate from an external network.
Accordingly, it is an object of the current invention to provide a computer intercepting system and method that does not utilize a firewall, or other form of proxy server.
It is another object of the current invention to provide a computer intercepting system and method that does not have a central point of failure.
It is a further object of this current invention to provide a computer intercepting system and method that will not add latency to the system.
Also, it is an object of the current invention to enable all of the bandwidth to be utilized while the computer security system is being accessed.
It is yet another object of the current invention to provide protection from attacks by users on the internal network.
Other objects and advantages of this invention will become apparent from the description taken in connection with the accompanying drawings that are presented by way of illustration and example.
These and other objects of the present invention are provided by a computer system and method for intercepting, examining, and controlling data streams flowing via transport connections between the transport layer of an operating system and the user application. Preferably, the computer system and method operates on a single computer system. The system and method protect the computer from invasion by viruses, trojan horses, worms, and other hostile algorithms.
The method of this invention preferably operates within a single computer system. Advantageously, the data streams that pass from the transport layer of an operating system to the user application or from the user application to the transport layer must be intercepted by the novel network traffic interceptor xe2x80x9cNTIxe2x80x9d of the current invention. The NTI processes all data streams for proscribed data that may include viruses, trojan horses, worms, manually typed hostile commands, other hostile algorithms, and forbidden data. The processing used by the NTI can include monitoring, blocking, logging, quarantining, destroying or passing on data. Because all data must be process by the NTI before being passed to the user application, the NTI can block proscribed data before it has the ability to infect the computer.
The NTI prevents the proscribed data from altering other data streams in the computer system in a manner that changes the data streams or harms the computer program. As a result, the data streams and programs continue to function as intended and programmed rather than functioning pursuant to the unauthorized commands of the viruses, trojan horses, worms, manually typed hostile commands, and hostile algorithms. In addition, proscribed data includes forbidden data, which is data that the programmer blocks from being accessed by the computer. An example of forbidden data would be pornographic material on a computer used by children.
This method is an intercepting method contained within a single computer system, rather than a firewall system utilizing a separate proxy server. As a result, only the individual computer system is impacted by utilization of the NTI and its use does not add latency to the entire system. In addition, because the NTI is located within a single computer system, hostile algorithms originating outside the system but within the internal network still cannot by-pass the NTI to infect the individual computer.
The system of the present invention utilizes a single computer system connected via a transport connection to an external network. Data from the external network passes to the transport layer of the operating system within the single computer system. Transport connections pass the data to the NTI, where the data is processed before allowing the data to pass via transport connections to the user application. The data flow may also operate in the reverse direction wherein it originates in the user application and passes to the external network.